Closed eehret closed 5 months ago
UPDATE: After interrogating the metadata a bit more I've discovered that apparently the Windows one is marked as modifiable in the metadata, whereas the Linux one is not:
Windows:
PS > Get-AzPolicyAlias -NamespaceMatch 'compute' | Select-Object -ExpandProperty 'Aliases' | Where-Object { $_.Name -eq 'Microsoft.Compute/virtualMachines/osProfile.windowsConfiguration.patchSettings.patchMode' }
Name : Microsoft.Compute/virtualMachines/osProfile.windowsConfiguration.patchSettings.patchMode
Paths : {Microsoft.Azure.Management.ResourceManager.Models.AliasPath}
Type :
DefaultPath : properties.osProfile.windowsConfiguration.patchSettings.patchMode
DefaultPattern :
DefaultMetadata : Microsoft.Azure.Management.ResourceManager.Models.AliasPathMetadata
PS /home/eric> $alias= Get-AzPolicyAlias -NamespaceMatch 'compute' | Select-Object -ExpandProperty 'Aliases' | Where-Object { $_.Name -eq 'Microsoft.Compute/virtualMachines/osProfile.windowsConfiguration.patchSettings.patchMode' } PS /home/eric> $alias.DefaultMetadata
Type Attributes
---- ----------
String Modifiable
Linux:
PS > Get-AzPolicyAlias -NamespaceMatch 'compute' | Select-Object -ExpandProperty 'Aliases' | Where-Object { $_.Name -eq 'Microsoft.Compute/virtualMachines/osProfile.linuxConfiguration.patchSettings.patchMode' }
Name : Microsoft.Compute/virtualMachines/osProfile.linuxConfiguration.patchSettings.patchMode
Paths :
Type :
DefaultPath : properties.osProfile.linuxConfiguration.patchSettings.patchMode
DefaultPattern :
DefaultMetadata :
Note the blank DefaultMetadata structure in the Linux alias.
If I am misinterpreting anything here, I apologize. I'm certainly not an expert in this area. Just hoping this helps someone fix this quickly, or perhaps reveal a workaround that I haven't yet thought of :)
You're not misinterpreting things. I tested this with windows and it works. With Linux not.
as a workaround but in this case all policies just evaluate as compliant. So there seems to be a problem there as well
Looks like same problem exists for: bypassPlatformSafetyChecksOnUserSchedule & enableHotpatching
Looks like someone took notice of this issue and fixed it, although this issue remained open.
Here's what I am seeing now for the same command I issued above before that was showing the broken/missing alias.
PS /home/eric> Get-AzPolicyAlias -NamespaceMatch 'compute' | Select-Object -ExpandProperty 'Aliases' | Where-Object { $_.Name -eq 'Microsoft.Compute/virtualMachines/osProfile.linuxConfiguration.patchSettings.patchMode' }
Name : Microsoft.Compute/virtualMachines/osProfile.linuxConfiguration.patchSettings.patchMode
Paths : {Microsoft.Azure.Management.ResourceManager.Models.AliasPath}
Type :
DefaultPath : properties.osProfile.linuxConfiguration.patchSettings.patchMode
DefaultPattern :
DefaultMetadata : Microsoft.Azure.Management.ResourceManager.Models.AliasPathMetadata
Closing myself, since this is no longer an issue and I should be able to create the policy I needed to create now due to the fix.
Scenario
Because of existing issues in the current Update Manager built-in policies that do not set
patchMode
correctly on virtual machines when the setting gets modified (currently a limitation of built-in policy/providers/Microsoft.Authorization/policyDefinitions/ba0df93e-e4ac-479a-aac2-134bbae39a1a
), I am trying to supplement the built-in policies with a custom one that modifiespatchMode
to the desired setting (which in our case isAutomaticByPlatform
whenever it is detected to be incorrect.Unfortunately it appears that right now the aliases we need is not modifiable by policy. The aliases are:
The following command shows that the alias does exist , so I guess it's read only and not modifiable:
Proposed Definition
This is basically a clone of the built-in policy
/providers/Microsoft.Authorization/policyDefinitions/59efceea-0c96-497e-a4a1-4eb2290dac15
, but for settingpatchMode
instead ofassessmentMode